Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe
- Size 395KB
- Sample260709-eepmzscv2j
- SHA256 2388b56ad5ee0d921462f156bc8721933b8f4e84db6aab30d722f85a6709f817
- MD5 34c28bbdd02887dd59630efb39f9140c
- SHA1 e734d13dcb44f1c4fb5356449d53dbb7e580d9dd
- SHA512 912731ad2e4c436753941b607e7287f392f4f068ed4898fcd1440040176be7496234a9336681cdb852f1f9e4721d0eb4cf69483deaa50a3f445e4a08d092a8a1
- SSDEEP 6144:GjuDOhVLS5nj+CPXIYgtiP/aK2h9H/B+biiuW1FXE8:GaoVmp+84YgcP/aK2vB+WiuWXx
- TLSH T14E84381232F04AB9F0BB563158755B7596BBFC329E2197EF17802E6C3E309409A21B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2092 googleupdate32.exe 4908 eventviewer.exe - Loads dropped DLL 8 IoCs
pid Process 4908 eventviewer.exe 4908 eventviewer.exe 4908 eventviewer.exe 4908 eventviewer.exe 4908 eventviewer.exe 4908 eventviewer.exe 4908 eventviewer.exe 4908 eventviewer.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\syslog.exe 2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe File created C:\Windows\SysWOW64\eventviewer.exe 2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\program files\java\jdk-1.8\bin\pack200.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\keytool.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\installer\setup.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\java-rmi.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\java.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\javaws.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\ssvagent.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\javaws.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\rmid.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\cnfnot32.exe eventviewer.exe File opened for modification C:\program files\internet explorer\ieinstal.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javaws.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\integration\addons\onedrivesetup.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.loader.exe eventviewer.exe File opened for modification C:\program files\7-zip\uninstall.exe eventviewer.exe File created C:\program files\dotnet\dotnet.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\keytool.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\wsimport.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\pack200.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jp2launcher.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\pack200.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\excelcnv.exe eventviewer.exe File created C:\program files\7-zip\7zfm.exe eventviewer.exe File opened for modification C:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\createdump.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\native2ascii.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\serialver.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jinfo.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\java.exe eventviewer.exe File created C:\program files\7-zip\uninstall.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\msinfo\msinfo32.exe eventviewer.exe File opened for modification C:\program files\google\chrome\application\chrome_proxy.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jconsole.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\jdeps.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\rmiregistry.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\client\appvlp.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx40.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\javac.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\orbd.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\rmid.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\clicktorun\integratedoffice.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\jjs.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\ktab.exe eventviewer.exe File created C:\program files\java\jdk-1.8\jre\bin\orbd.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jabswitch.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\rmiregistry.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\keytool.exe eventviewer.exe File opened for modification C:\program files\java\jre-1.8\bin\rmid.exe eventviewer.exe File created C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.netfx45.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\office16\liclua.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\servertool.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\jabswitch.exe eventviewer.exe File created C:\program files\java\jre-1.8\bin\jabswitch.exe eventviewer.exe File opened for modification C:\program files\microsoft office\root\office16\addins\microsoft power query for excel integrated\bin\microsoft.mashup.container.loader.exe eventviewer.exe File created C:\program files\google\chrome\application\140.0.7339.81\chrome_pwa_launcher.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jjs.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\orbd.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\jre\bin\java-rmi.exe eventviewer.exe File created C:\program files\microsoft office\root\integration\addons\onedrivesetup.exe eventviewer.exe File opened for modification C:\program files\common files\microsoft shared\clicktorun\appvcleaner.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\jar.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\javapackager.exe eventviewer.exe File created C:\program files\java\jdk-1.8\bin\native2ascii.exe eventviewer.exe File opened for modification C:\program files\java\jdk-1.8\bin\rmiregistry.exe eventviewer.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eventviewer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language googleupdate32.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4908 eventviewer.exe 4908 eventviewer.exe 4908 eventviewer.exe 4908 eventviewer.exe 4908 eventviewer.exe 4908 eventviewer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1356 wrote to memory of 2092 1356 2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe 86 PID 1356 wrote to memory of 4908 1356 2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_34c28bbdd02887dd59630efb39f9140c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_nymaim_rhadamanthys.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe"googleupdate32.exe "2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092
-
-
C:\Windows\SysWOW64\eventviewer.exe"C:\Windows\system32\eventviewer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4908
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
- Size 701B
- SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
- MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
- SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
- SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
- TLSH T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
- Size 192B
- SHA256 295bf7e3903e15d628ee32699ee80cf52270a076718066e9a8330a843ab4466b
- MD5 b75ade0a277d4d245ae7e047ed2bdf9d
- SHA1 f4d64d4a1f6db8baa840abeb2a2d7b340e7e102f
- SHA512 746db2e0a085c47e1bd00b175ab6f3185b4cdb54cf6211f988a1cb91431f26ee727d70b62f9090d698b518b0a54c80796a3f7a4775a27a2f41eb52187d256ce1
- TLSH T1B6C0920C67A28325F2D897B9529262828B90A610F991AB1616B60A0C9A3AF152870D6A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\googleupdate32.exe
- Size 158KB
- SHA256 0c48c63acec1892ecf03ab327d6584adfe084e8470d165a91f793d7c28f70eeb
- MD5 5722709cb676e5b6f2473943f9e71632
- SHA1 f825840cb4ac0427340e407598ae4ab558dd7453
- SHA512 53ef1bc3b321c03b1a4bd2c6757115109ecafe6305e2ae9872e09f636968c5cfcb1dd29b094aac2a09f390f193de57ad02e88a56f5c7b0f344db898f51009b30
- SSDEEP 3072:uwzvOYNt5YP/aKavT/DvbEvK9aobNI2B+Il4DLWr0Cl2f1DuF9Qttsi9sCiNNB6G:ltiP/aK2h9H/B+bs
- TLSH T1C4F3E71676F8116DF0B36B3169799B519AB9FC32DE20DB7E16C00A6D0E30940EA21F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\eventviewer.exe
- Size 88KB
- SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
- MD5 188a727732ea436cedbfa4f016e7bbdf
- SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
- SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
- SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
- TLSH T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\syslog.exe
- Size 148KB
- SHA256 0276c20790d9fa6b0607b29f632c72e8bb4a07e9495c9858730f8a0930f9237d
- MD5 c77a7e16f85637827514b13d5b586f76
- SHA1 05775016364462afafccc226268373de15956815
- SHA512 2d4732d8e49e8a7cec26d870973f331d8cdbc404349af37f730cd402a8e07123535e90e5d71484f86343d9662397b7488635ac159bc1611641222a08b1bed7a2
- SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nj+CB5XIYnQB:GjuDOhVLS5nj+CPXIYy
- TLSH T1B7E3481232D0CFB9E1AF45318DA29AB546B7FC319D3297CB63907E0D3E359418A26763
- MD5 SHA1 SHA512 SSDEEP TLSH